Six Flags’ Scan of Boy’s Thumbprint Tests Biometric Privacy Law

An Illinois mother’s suit alleging Six Flags Entertainment Corp. scanned her 14-year-old son’s thumbprint without her written consent is headed to the state’s highest court, which will determine whether plaintiffs have to show harm to sue under the state’s biometric privacy law.

The state Supreme Court will decide the threshold for cases brought under the law amid a wave of such cases against Southwest Airlines Co., Wendy’s International Inc., Hooters Management Corp., Presence Health Network and other employers, retailers and service providers.

A state appeals court held last December in the case, Rosenbach v. Six Flags Entertainment Corp., that plaintiff Stacy Rosenbach didn’t have standing to sue because she didn’t show an injury or adverse effect to qualify as an “aggrieved party” under Illinois’ Biometric Information Privacy Act. Rosenbach alleged Six Flags broke the law when it scanned her son’s thumbprint as part of his season pass entry into Six Flags Great America in Gurnee, Ill. without written consent.

Illinois was the first state to enact a law governing the privacy of biometric data, such as fingerprints and retinal scans. The Illinois statute is the only one that includes a private right of action enabling lawsuits such as Rosenbach’s. The high court’s decision will determine how difficult it will be for plaintiffs to keep pressing such lawsuits.

“If the court upholds the principle that a technical violation does not result in an aggrieved person, I think it will knock out a number of cases,” Jeffrey Neuburger, a partner at Proskauer Rose LLP in New York, said. “Creative plaintiff lawyers will do what they can to survive, but I think it would be fatal for many of those cases.”

Another Illinois appeals court has since ruled in a different case that plaintiffs don’t need to demonstrate any particular harm to file a lawsuit alleging the law was broken.

Illinois circuit courts have seen more than 100 BIPA cases over the last two years, Bloomberg Law data show. Attorneys defending businesses in BIPA actions said that only a few cases have been settled or tossed so far.

The Illinois Chamber of Commerce and the National Federation of Independent Business are backing Six Flags in the case. The Electronic Privacy Information Center, the American Civil Liberties Union and other technology and civil liberties groups are siding with Rosenbach.

The Illinois Supreme Court hasn’t set a date for oral argument, but a court spokesman said it likely would occur during the third week of November.

Cases Target Employers

Employers want plaintiffs to have to demonstrate injury or some adverse effect to have standing to sue.

The Restaurant Law Center, the legal advocacy arm of the National Restaurant Association, emphasized in a high court brief that 88 percent of the current BIPA actions challenge an employer’s use of biometric devices, such as time clocks that read fingerprints, to keep track of employees’ work hours. The industry group argued any standard that does not include a showing of harm, “could have a devastating impact on thousands of Illinois employers who have used scan-based timekeeping openly in good faith to comply with state and federal work hour tracking.”

Consumer and civil liberties groups argue that the private sector is trying to impose a requirement that state lawmakers didn’t envision. A requirement to show harm would dilute the public’s ability to enforce BIPA, they say.

“For us, it’s critically important that the law be enforceable,” Alan Butler, senior counsel at EPIC, told Bloomberg Law.

Fingerprints and Facial Scans

Employers and businesses are limited under BIPA in how they can collect and use biometric information from employees and customers. The law requires written notice to and consent from individuals to collect and store their biometric data, such as fingerprints or facial scans.

Penalties for violating the law can be substantial—$1,000 per negligent violation and $5,000 per willful or reckless violation.

The high court will be hearing argument just a few weeks after a different Illinois appeals court on Sept. 28 ruled plaintiffs don’t have to show injury or an adverse effect to demonstrate they have been sufficiently “aggrieved” to bring a viable claim. Consumer, privacy and civil liberties groups hailed that decision, in Sekura v. Krishna Schaumberg Tan Inc.

In the case, Klaudia Sekura alleged that Krishna, an L.A. Tan franchisee, collected her fingerprints when she opened her membership and then failed to protect the information in violation of the Illinois law. Sekura alleged Krishna collected biometric information without obtaining proper releases and disclosed such information to SunLync, an out-of-state vendor.

Privacy advocates said the Supreme Court should look to the Sekura decision when it weighs the case against Six Flags.

“This is a very straightforward and unambiguous statute. The clear purpose of the statute was to give consumers a measure of control over their biometric data by ensuring they understood what data was being collected and for what purposes,” said Rebecca Glenberg, a senior staff attorney with ACLU-Illinois.

Butler said the Sekura precedent could put plaintiffs on an even footing with business interests and employers when Rosenbach is argued before the Supreme Court. The “presumption is against the person challenging a judicial ruling,” Butler, who filed a friend of the court brief on behalf of EPIC in support of the Rosenbach plaintiffs, said.

“But when there are two decisions from the same body and they go in different directions, it’s less of an uphill battle to win on this question in the Illinois Supreme Court,” he said.